Skip to main content
Feedback

XML Threat Protection Policy

The xml-threat-protection policy protects APIs against malicious XML payloads by validating limits specified in the XML structures, including elements, entities, attributes, and string values. When a payload exceeds any configured structural limit, the policy rejects the request with a 400 status code and a relevant response string.

Description

  • Configured limits apply to XML element count, nesting depth, document length, attributes per element, attribute value length, children per element, text value length, entity expansion count, and entity expansion depth. External entity resolution is controlled separately by the allowExternalEntities boolean property, which defaults to false.

  • When any configured limit is exceeded, the gateway blocks the request and returns a 400 response. The backend does not receive the request.

  • The following conditions trigger a rejection:

    • The XML payload is malformed or syntactically invalid.

    • An XML document contains more elements than the configured maxElements limit. For example, if maxElements is set to 10 and an incoming document has 11 elements, the policy rejects the request.

    • The XML nesting depth exceeds the configured maxDepth limit. For example, if maxDepth is set to 5 and a document has 6 levels of nested elements, the policy rejects the request.

    • The total document length exceeds the configured maxLength character limit.

    • An XML element contains more attributes than the configured maxAttributesPerElement limit.

    • An attribute value exceeds the configured maxAttributeValueLength character limit.

    • An element contains more child elements than the configured maxChildrenPerElement limit.

    • A text node value exceeds the configured maxTextValueLength character limit.

    • The number of entity expansions exceeds the configured maxEntities limit.

    • The depth of nested entity expansions exceeds the configured maxEntityDepth limit.

    • The XML document contains an external entity reference, and allowExternalEntities is set to false (the default).